63 lines
No EOL
1.8 KiB
Text
63 lines
No EOL
1.8 KiB
Text
|
|
|
|
|
|
[Unit]
|
|
Description=Kanidm identity server
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Container]
|
|
ContainerName=kanidm
|
|
|
|
NoNewPrivileges=true
|
|
Image=docker.io/kanidm/server:latest
|
|
|
|
ReadOnly=true
|
|
# Volume=/run/podman/podman.sock:/var/run/docker.sock:z
|
|
Volume=/var/opt/kanidm_data:/data:Z
|
|
# Volume=kanidm-certs.volume:/data/certs:z
|
|
Volume=traefik-certs.volume:/data/certs:ro
|
|
Volume=/etc/kanidm/entrypoint.sh:/entrypoint.sh:ro,z
|
|
Volume=/etc/kanidm/data/server.toml:/data/server.toml:ro,z
|
|
|
|
Exec="/entrypoint.sh"
|
|
|
|
AutoUpdate=registry
|
|
Network=web.network
|
|
|
|
|
|
Label="traefik.enable=true"
|
|
Label="traefik.http.routers.kanidm.rule=Host(`idm.ellis.link`)"
|
|
Label="traefik.http.routers.kanidm.entrypoints=https"
|
|
Label="traefik.http.routers.kanidm.service=kanidm"
|
|
|
|
# Label="traefik.tcp.routers.kanidm-tcp.rule=HostSNI(`idm.ellis.link`)"
|
|
# Label="traefik.tcp.routers.kanidm-tcp.service=kanidm"
|
|
|
|
# Kanidm is a bit odd here
|
|
Label="traefik.http.services.kanidm.loadbalancer.server.port=8443"
|
|
Label="traefik.http.services.kanidm.loadbalancer.server.scheme=https"
|
|
Label="traefik.http.services.kanidm.loadbalancer.serversTransport=kanidm@file"
|
|
# Label="traefik.http.serversTransports.kanidm.insecureSkipVerify=true"
|
|
|
|
Label="traefik.http.middlewares.compress.compress=true"
|
|
|
|
Label="traefik.http.middlewares.hsts.headers.stsincludesubdomains=false"
|
|
Label="traefik.http.middlewares.hsts.headers.stspreload=true"
|
|
Label="traefik.http.middlewares.hsts.headers.stsseconds=31536000"
|
|
Label="traefik.http.middlewares.hsts.headers.isdevelopment=false"
|
|
|
|
Label="traefik.http.routers.kanidm.middlewares=compress" # hsts,
|
|
|
|
Label="homepage.group=Services"
|
|
Label="homepage.name=Kanidm"
|
|
Label="homepage.href=https://idm.ellis.link/"
|
|
Label="homepage.description=Identity server"
|
|
|
|
|
|
[Service]
|
|
Restart=on-failure
|
|
TimeoutStartSec=900
|
|
|
|
[Install]
|
|
WantedBy=default.target |